Rasmus Wriedt Larsen
c839f35485
Python: FastAPI: Proper modeling of implicit returns
2021-09-30 19:14:15 +02:00
Rasmus Wriedt Larsen
50147708bf
Python: FastAPI: Model response classes
...
Figuring out how to do the `media_type` tracking was quite difficult.
2021-09-30 19:14:15 +02:00
Rasmus Wriedt Larsen
eef946a0c8
Python: FastAPI: Add test for custom response annotation
...
It really is rather contrived, but it also _does_ work.
2021-09-30 19:14:15 +02:00
Rasmus Wriedt Larsen
c9895b54fe
Python: FastAPI: Add tests for direct response construction
2021-09-30 19:14:14 +02:00
Rasmus Wriedt Larsen
c50c805f5f
Python: FastAPI: Model Cookie Writes
2021-09-30 19:14:14 +02:00
Rasmus Wriedt Larsen
d34c5fd72f
Python: FastAPI: Add tests with response parameter
2021-09-30 19:14:14 +02:00
Rasmus Wriedt Larsen
285de2b4c8
Python: FastAPI: Add support for APIRouter
2021-09-30 19:14:14 +02:00
Rasmus Wriedt Larsen
b1f8b5352b
Python: FastAPI: Add support for api_route
...
Note that `route` did not actually work (that also comes from the
underlying web framework library Starlette)
2021-09-30 19:14:14 +02:00
Rasmus Wriedt Larsen
3661ff3bd8
Python: Add basic FastAPI support
2021-09-30 19:14:14 +02:00
Rasmus Lerchedahl Petersen
cc1c32cf0e
Python: model file accesses
2021-09-29 16:53:25 +02:00
Rasmus Lerchedahl Petersen
3c1206f873
Python: Model more awaiting construcs
...
in API graphs.
Some unsatisfactory lack of understanding here.
2021-09-27 16:41:01 +02:00
Rasmus Lerchedahl Petersen
f6311bf051
Python: model other awaiting constructs
2021-09-27 14:32:55 +02:00
Rasmus Lerchedahl Petersen
15b07bfcc0
Python: Model sql executions
2021-09-27 14:15:58 +02:00
Rasmus Wriedt Larsen
ded3088529
Python/JS: Recognize SHA-3 hash functions
...
Official names are SHA3-224, SHA3-256, SHA3-384, SHA3-512 as per
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
2021-09-27 12:08:40 +02:00
Rasmus Lerchedahl Petersen
520a2da8ab
Python: Add tests for asyncpg
2021-09-24 14:41:50 +02:00
Rasmus Lerchedahl Petersen
f2fbeed490
Python: Model os.path-functions
2021-09-23 15:30:00 +02:00
Rasmus Lerchedahl Petersen
81adb7dd2a
Python: Add tests for os.path-functions
2021-09-23 15:28:05 +02:00
Rasmus Wriedt Larsen
8badba26b8
Python: Minor SQLALchemy comment fixes
2021-09-22 13:58:29 +02:00
Rasmus Wriedt Larsen
c7c8e2f3e3
Merge branch 'main' into promote-sqlalchemy
2021-09-21 09:36:07 +02:00
Anders Schack-Mulligen
f30dad7705
Dataflow: Update test expected outputs.
2021-09-07 13:02:20 +02:00
Rasmus Wriedt Larsen
d55f18f8e3
Python: Add modeling of Flask-SQLAlchemy
2021-09-02 10:48:24 +02:00
Rasmus Wriedt Larsen
f1744890b1
Python: Add tests for Flask-SQLAlchemy
2021-09-02 10:48:15 +02:00
Rasmus Wriedt Larsen
c34d6d1162
Python: Add query to handle SQLAlchemy TextClause Injection
...
instead of doing this via taint-steps. See description in code/tests.
2021-09-02 10:19:57 +02:00
Rasmus Wriedt Larsen
81dbe36e99
Python: Promote SQLAlchemy modeling
...
Due to the split between `src/` and `lib/`, I was not really able to do
the next step without having moved the SQLAlchemy modeling over to be in
`lib/` as well.
2021-09-02 10:19:57 +02:00
Rasmus Wriedt Larsen
47377c7197
Merge branch 'main' into more-modeling
2021-08-26 13:40:17 +02:00
Rasmus Wriedt Larsen
b649f5f38c
Merge branch 'main' into peewee-modeling
2021-08-17 12:03:18 +02:00
Rasmus Wriedt Larsen
38875ca0c7
Python: Improve handling of async methods
2021-07-22 14:17:07 +02:00
Rasmus Wriedt Larsen
6e9d9fcbbd
Python: Improve taint steps in for & iterable unpacking
...
These were written way before the ones in DataFlowPrivate, but
apparently didn't cover quite as much :|
2021-07-22 14:16:17 +02:00
Rasmus Wriedt Larsen
6f63c03558
Python: Model http.cookies.Morsel and usage in Tornado
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
7e09a1cbfd
Python: Model tornado.httputil.HTTPHeaders
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
7020e4132b
Python: Model BaseHTTPRequestHandler.rfile as file-like object
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
d388dd547e
Python: Model HTTPMessage from Stdlib
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
dac71ded9d
Python: Add Authorization modeling in Flask
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
133632119d
Python: Model werkzeug Headers
...
Also removed a misleading comment link to method on wrong class :D
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
4d9c86a252
Python: Model Werkzeug FileStorage.save as FileSystemAccess
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
9cb4899c5c
Python: Add FileStorage modeling in Flask
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
04190ea308
Python: Add file-like modeling to werkzeug FileStorage
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
4f4dec50f2
Python: Model ResovlerMatch in Django
...
Like before, omitted ClassInstantiation
2021-07-22 10:43:13 +02:00
Rasmus Wriedt Larsen
7dc6518350
Python: Add FileLikeObject modeling
...
Such that the result of `request.FILES["key"].file.read()` is tainted
2021-07-21 16:35:09 +02:00
Rasmus Wriedt Larsen
18c0d13efd
Python: Model most of UploadedFile in Django
2021-07-21 16:35:09 +02:00
Rasmus Wriedt Larsen
5ec5557203
Python: Model MultiValueDict in Django
2021-07-21 16:35:09 +02:00
Rasmus Wriedt Larsen
51b543c67c
Python: Model taint for django request methods
2021-07-21 16:35:09 +02:00
Taus
55d822cc56
Python: Add TypeTrackingNode
...
Splits `ModuleVariableNode` away from `LocalSourceNode`, instead
creating a class `TypeTrackingNode` that encapsulates both of these.
This means we no longer have module variable nodes as part of
`LocalSourceNode` (which is good, since they have no "local" aspect to
them), and hence we can have `LocalSourceNode` inherit directly from
`ExprNode` (which makes the API a bit nicer).
Unfortunately these are breaking changes, so we can't actually fulfil
the above two desiderata until the `track` and `backtrack` methods on
`LocalSourceNode` have been fully deprecated. For this reason, we
preserve the present implementation of `LocalSourceNode`, and instead
lay the foundation for switching over in the future, by deprecating
`track` and `backtrack` on `LocalSourceNode`.
2021-07-02 18:00:33 +00:00
yoff
6a77b890af
Merge pull request #6155 from RasmusWL/port-cleartext-queries
...
Python: Port cleartext queries
2021-06-30 15:52:34 +02:00
Rasmus Wriedt Larsen
c2708176b1
Python: Support %-style formatting for MarkupSafe
2021-06-30 14:15:41 +02:00
Rasmus Wriedt Larsen
0a4efd0e86
Python: Add %-style formatting tests for MarkupSafe
2021-06-30 14:13:59 +02:00
Rasmus Wriedt Larsen
075953860b
Merge branch 'main' into markupsafe-modeling
2021-06-30 13:55:08 +02:00
Rasmus Wriedt Larsen
97571e0b4f
Python: Add modeling of peewee
2021-06-25 17:50:59 +02:00
Rasmus Wriedt Larsen
c476c89de5
Python: Add tests for peewee
2021-06-25 16:08:57 +02:00
Rasmus Wriedt Larsen
68cfeb0b5c
Python: Model logging from the logging module
2021-06-25 14:26:35 +02:00
